T09 · Insecure Skill Coding Practices
Error
- Location
config.env:6- Finding
TLS Certificate Verification Disabled for IMAP and SMTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Imap Smtp Email Fixed
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to provide the promised email features, but it ships insecure defaults and credential-handling flaws that could expose mailbox access or affect local files.
Review this skill carefully before installing. It needs mailbox credentials and can read, send, and modify email state. Do not use the bundled config as-is: enable certificate verification, replace the hardcoded account settings, restrict allowed read/write directories, and avoid running setup where terminal output is logged until the password-printing fallback is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
setup.sh:303- Finding
Setup Script Prints Email Credentials to Terminal Output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imap.js:16- Finding
Attachment Download Allowlist Can Be Bypassed Through Symbolic Links
- Content
View full analysis
path.resolve(d.replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => resolved === dir || resolved.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${dirPath}' is outside allowed write directories`); } return resolved; } ``` The validated path is subsequently used for unrestricted file creation or overwrite: ```js const resolvedDir = validateWritePath(outputDir); if (!fs.existsSync(resolvedDir)) { fs.mkdirSync(resolvedDir, { recursive: true }); } const downloaded = []; for (const attachment of parsed.attachments) { if (specificFilename && attachment.filename !== specificFilename) { continue; } if (attachment.content) { const filePath = path.join(resolvedDir, sanitizeFilename(attachment.filename)); fs.writeFileSync(filePath, attachment.content); ``` ### Technical Analysis `path.resolve()` normalizes `.` and `..` components but does not resolve symbolic links. The validation therefore confirms only that the textual path begins with an allowed directory. It does not confirm that the filesystem object ultimately reached by that path remains inside the allowlist. For example, an allowed directory could contain a symlink named `out` that points to a directory outside the allowlist. A path such as `~/Downloads/out` passes the prefix check even though writes occur at ...[truncated 1535 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/smtp.js:15- Finding
File Read Allowlist Is Vulnerable to Check-to-Use Races
- Content
View full analysis
path.resolve(d.replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => realPath === dir || realPath.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${inputPath}' is outside allowed read directories`); } return realPath; } ``` For attachments, the validated canonical path is discarded and the original path is resolved again: ```js function readAttachment(filePath) { validateReadPath(filePath); if (!fs.existsSync(filePath)) { throw new Error(`Attachment file not found: ${filePath}`); } return { filename: path.basename(filePath), path: path.resolve(filePath), }; } ``` Body and subject files are also validated and then reopened by their original names: ```js if (options['subject-file']) { validateReadPath(options['subject-file']); options.subject = fs.readFileSync(options['subject-file'], 'utf8').trim(); } if (options['body-file']) { validateReadPath(options['body-file']); const content = fs.readFileSync(options['body-file'], 'utf8'); if (options['body-file'].endsWith('.html') || options.html) { options.html = content; } else { options.text = content; } } else if (options['html-file']) { validateReadPath(options['html-file']); options.html = fs.readFileSync(options['html-file'], 'u ...[truncated 1899 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The supplied code substantially matches the IMAP/read side of the description: it connects to IMAP, checks unread/all messages, fetches full content, searches, marks read/unread, lists mailboxes, parses attachments, and downloads attachments. However, the declared purpose explicitly includes sending email via SMTP and sending emails with attachments, and there is no SMTP logic or send-mail function in this code chunk. Additionally, the code has a concrete filesystem write capability for attachment downloads, which is an operational behavior not called out explicitly in the description, though it is closely related to attachment handling. The claim of multiple-account support is only partially supported here through account listing/config display, not through clear per-command account selection or simultaneous account operations in this chunk. Overall, this is a real description/behavior mismatch because a major declared capability—sending mail—is absent from the provided code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a combined IMAP/SMTP skill with substantial mailbox-reading and message-management features. The supplied code chunk is specifically an SMTP CLI: it creates an SMTP transporter, verifies connectivity, sends mail, supports attachments, reads subject/body content from local files, runs a connection test that sends a test message, and lists configured accounts. There is no evidence in this chunk of IMAP connections, inbox access, unread-message detection, message retrieval, search, or read/unread state changes. While sending email with attachments and multi-account-related configuration are consistent with part of the description, the actual behavior shown is materially narrower than the declared purpose, so this is a mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/imap.js --account work check
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/smtp.js --account work send --to foo@bar.com --subject Hi --body Hello
Known Vulnerable Dependency: linkify-it==5.0.0 — 2 advisory(ies): CVE-2026-48801 (LinkifyIt#match scan loop has quadratic algorithmic complexity); CVE-2026-59887 (linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on at)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The lockfile pins linkify-it 5.0.0, which has reported quadratic-complexity denial-of-service issues in its matching logic, including mailto: handling. In this skill, mail content is attacker-controlled input, so parsing crafted email bodies or headers could consume excessive CPU and degrade or block processing.
- Content
Known Vulnerable Dependency: nodemailer==8.0.4 — 9 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +6 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The bundled transitive nodemailer 8.0.4 under mailparser has multiple advisories, including CRLF/header injection and content resolution weaknesses. Because this skill sends and parses email and may handle untrusted addresses, headers, and message parts, exploitation could enable message/header manipulation, unauthorized content inclusion, or denial of service depending on reachable code paths.
- Content
Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The top-level dependency nodemailer 7.0.13 is flagged by multiple advisories affecting header parsing, content resolution, and denial-of-service behavior. This is especially relevant in an IMAP/SMTP skill because it directly constructs outbound email from potentially user-controlled fields like recipients, subject, headers, and attachments.
- Content
Known Vulnerable Dependency: semver==5.3.0 — 1 advisory(ies): CVE-2022-25883 (semver vulnerable to Regular Expression Denial of Service)
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
semver 5.3.0 is affected by a regular-expression denial-of-service issue, but here it appears only as a transitive dependency of utf7 used by imap. The practical risk is lower because exploitation requires attacker influence over semver parsing inputs, which is less obvious in normal email-processing flows than the other findings.
- Content
Known Vulnerable Dependency: nodemailer==7.0.13 — 10 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +7 more
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The package declares nodemailer 7.0.13, which is reported as affected by multiple advisories including CRLF/header injection, denial-of-service, and bypass issues. In the context of an IMAP/SMTP skill, this is especially dangerous because the library is central to composing and sending email, so crafted inputs could potentially manipulate headers, bypass safeguards, or disrupt service.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const dotenv = require('dotenv'); // Split config: secrets in OC .env, connection settings in skill config.env const OC_ENV_PATH = path.join(os.homedir(), '.openclaw', '.env'); const SKILL_CONFIG_PATH = path.resolve(__dirname, '../config.env'); const LEGACY_ENV_PATH = path.join(os.homedir(), '.config', 'imap-smtp-email', '.env');